A provider of data communications services typically provides a customer access to a large data communication network. This access may be provided at an “edge device” that connects a customer network to the large data communication network. The edge device may be, for instance, a router or a switch. As such service providers have a broad range of customers with a broad range of needs, the service providers prefer to charge for their services in a manner consistent with which the services are being used. Such an arrangement also benefits the customer. To this end, a Service Level Agreement (SLA) is typically negotiated between customer and service provider.
According to searchWebServices.com, an SLA is a contract between a network service provider and a customer that specifies, usually in measurable terms, what services the network service provider will furnish. In order to enforce the SLA, these service providers often rely on “policing”.
Policing involves the inspection of traffic and then the taking of an action based on various characteristics of that traffic. These characteristics may be, for instance, based on whether the traffic is over or under a given rate, or based on some bits in the headers of the traffic. Such bits may include a Differentiated Services Code Point (DSCP) or an indication of “IP Precedence”. Although a “policer” (that which implements policing) may be a software element, today most policers are implemented in hardware. However, newer technologies are implementing policers as a combination of hardware and firmware. Such an implementation allows for high performance and high scalability to support thousands of flows and/or connections.
A policer may either discard a packet of traffic or modify some aspect of the packet of traffic, such as the Internet Protocol (IP) Precedence of the packet of traffic, when it is determined, by the policer, that the packet of traffic meets a given criterion. As an example, the policer can police based on such traffic attributes as the aggregate maximum bandwidth allowed for a set of flows, the maximum bandwidth allowed for each single flow, number of flows allowed and special treatment to be applied to any excess traffic.
Historically, service providers could furnish a customer with a dedicated point-to-point connection to, for instance, connect a branch office to a main office. However, service providers have been evolving to offer leased line connections over shared network infrastructure. That is, a dedicated line is used from one end point of the leased line (the customer network) to the service provider edge device, but the service provider uses a shared network to connect to the other end point of the leased line. This is often accomplished using Layer 2 technologies like Frame Relay and Asynchronous Transfer Mode (ATM). “Layer 2” is the Data Link layer of the commonly-referenced multi-layered communication model, Open Systems Interconnection (OSI).
With the use of these Layer 2 technologies, policing has become an important tool at service providers' edge devices for enforcement of SLAs, avoidance of Denial of Service (DoS) attacks and careful and accurate bandwidth management. Services policers that enforce SLAs for the above-mentioned types of Layer 2 technologies are well understood, implemented and deployed in known networks. For example, ATM Generic Cell Rate Algorithm (GCRA) policers implement policing on a per Virtual Connection/Virtual Path (VC/VP) basis. Based on preset criteria, an ATM cell received at a GCRA policer at a service provider edge device may be either transmitted into the shared network infrastructure or discarded.
However, as service providers evolve and the services provided change and improve, there may be a requirement for an improved services policer.